Security Alert Summary
The WooCommerce Infinite Scroll and Ajax Pagination plugin for WordPress has a PHP Object Injection vulnerability (CVE-2025-11993) in its import feature. The plugin deserializes untrusted data from an import parameter without capability checks, allowing authenticated users with Subscriber-level access or higher to supply serialized objects. When a gadget chain exists in another installed plugin or theme, this can lead to file deletion, data disclosure, or remote code execution.
CVE Details
- CVE ID: CVE-2025-11993
- Affected component: WooCommerce Infinite Scroll and Ajax Pagination plugin
- Affected versions: All versions up to and including 1.8
- Published: May 29, 2026 at 7:16:13 AM UTC
- Last modified: May 29, 2026 at 1:09:05 PM UTC
- CVSS v3.1: Base Score 8.8, Severity HIGH, Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- Authentication / Privileges / User Interaction: Requires an authenticated user account with low privileges (Subscriber-level or higher). No user interaction required.
- Primary impact: Confidentiality: High; Integrity: High; Availability: High
- Weakness (CWE): CWE-502
Technical Details
The plugin exposes an import configuration feature that accepts a settings parameter which is deserialized by the plugin in the import_settings function. The deserialization step occurs without appropriate capability or permission checks, allowing authenticated users with Subscriber-level access or higher to provide crafted serialized PHP objects.
The vulnerable code path performs deserialization of attacker-controlled data. The plugin itself does not contain a POP (property-oriented programming) chain, but if another installed plugin or theme provides a usable POP chain, an attacker could leverage that chain to perform actions such as deleting files, retrieving sensitive data, or executing arbitrary code on the server.
How This Could Impact Your Website
In a typical WordPress site with multiple users, an internal contributor or an external contractor who has a Subscriber or higher account could trigger the vulnerable import functionality. Practical consequences include exposure of internal user data, increased risk of targeted phishing or social engineering if email addresses or other user details are exposed, and the possibility of destructive actions or code execution if a POP chain exists elsewhere on the site.
For example, a site owner might invite an external contributor to manage content. That contributor could upload a crafted import file which, when processed by the plugin, attempts to instantiate objects that interact with other plugins or themes. If those other components provide exploitable gadget chains, an attacker could escalate the impact beyond data disclosure to file deletion or remote code execution.
If youâre unsure whether your site is affected or how to assess your current user roles and plugins, it may be worth having a professional review your setup.
Recommended Actions
- Update the affected plugin as soon as a patched version is available.
- Review and reduce unnecessary user roles, especially accounts with Contributor or higher privileges.
- Enforce strong passwords and enable two-factor authentication for editors and administrators.
- Remove unused or unmaintained plugins and themes that may provide gadget chains.
- Monitor site activity and logs for unusual behavior around import features and file operations.
If youâd like help reviewing your plugins, user roles, or overall WordPress security posture, our team at Freshy is happy to help.
